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1. Browser requests login page 



2. Web server sends login page containing authentication plugin 
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o a *u 4. Authentication plugin sends results to CGI Script ojS 

3. Authentication plugin r * 

runs in browser, scans r 
host, generates results 




6. CGI redirects Browser to appropriate page 




5. CGI script evaluates 
results, decides whether to 
redirect user to logon page 
or redirect user to access 
denied page 
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Browser requests ActiveX Control 
(scanner) 
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ActiveX control sent to browser 
■. (scanner) 
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Browser verifies signature, 
prompts user, runs 
ActiveX control, which 
performs scan, generates 
result report, redirects 
browser to report page, 
and may also fix some or 
all security risks 




(Optional) Browser submits 
results to web server application 
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